Out-of-Path with WCCP : Overview

Overview
In this scenario, the Silver Peak appliances are not connected in the direct path of the network traffic. As a result, a network traffic redirection technique is used to forward traffic to the appliance.
Web Cache Coordination Protocol (WCCP) supports the redirection of any TCP or UDP connections to appliances participating in WCCP Service Groups. The appliance intercepts only those packets that have been redirected to it. The appliance accelerates traffic flows that the Route Policy directs to a tunnel; all other traffic passes through the appliance unmodified.
In the unlikely event that the appliance fails, WCCP on the WAN router removes the appliance from the WCCP Service Group and resumes forwarding traffic normally, according to its routing tables.
At Site A, both the router and the participating appliance require a separate WCCP service group for each protocol used in the tunnel. So, if a tunnel uses both TCP and UDP, you must create a separate WCCP Service Group for each protocol (TCP and UDP) used in the A-to-B tunnel.
Network Diagram
Out-of-Path Deployment: Silver Peak Appliance peered with an L3 router using WCCP
The Silver Peak appliances optimize traffic to/from 172.60.10.0/24 and 172.80.10.0/24.
Note You don’t need a spare router port for this configuration. The Silver Peak appliance can be connected to an existing LAN segment and be multiple hops away.
Summary
Appliance wan0 interface connects to network
Do not connect lan0 interface
Fail-Safe Behavior
Fail-safe behavior should always be tested before production deployment by ensuring that traffic continues to flow in each of the following cases:
1
2
3
Summary of Configuration Tasks
Connect each appliance’s wan0 interface to the network, reachable by the WAN router. Do not cable anything to an appliance’s lan0 interface.
Access the Site A router’s command line interface (CLI) to:
Configure an Access Control List (ACL) that redirects all traffic from the Site A subnet to the Site B subnet
Configure two WCCP Service Groups — one for UDP, one for TCP
Enable WCCP on the appropriate router interface
Configure Site A’s appliance for out-of-path deployment1
Access the Initial Config Wizard to assign Appliance IP and Management IP addresses for Site A’s appliance.
Ensure that the cable connections are sound and you haven’t misconfigured any IP addresses.
Do NOT proceed until you have verified connectivity.
Configure the WCCP Service Groups on Site A’s appliance
Create a tunnel and Route Policy on Site A’s appliance
Configure Site B’s appliance for in-line deployment2
Run the Initial Config Wizard to set up Site B’s Silver Peak appliance in Bridge mode.
Use this to ensure that the cable connections are sound and you haven’t misconfigured any IP addresses.
Do NOT proceed until you have verified connectivity.
Create a tunnel and Route Policy on Site B’s appliance
To allow traffic to start flowing, admin up the tunnels on all sides.
Verify the tunnel status and ensure that you’re able to access hosts through the tunnel.

1
IMPORTANT: The Appliance Next Hop IP Address must be the IP address of the WAN edge router. This may or may not be the same as the Management Interface Next Hop IP Address for hosts on the LAN side of your network. If in doubt, check with your network administrator.

2
IMPORTANT: The Appliance Next Hop IP Address must be the IP address of the WAN edge router. This may or may not be the same as the Management Interface Next Hop IP Address for hosts on the LAN side of your network. If in doubt, check with your network administrator.

Collecting the Necessary Information
The example makes the following assumptions:
n
n
Table 5‑1  Out-of-Path Deployment: Silver Peak Appliance peered with an L3 router using WCCP
Hostname
[limited to maximum of 24 characters]
Old
New / Confirm
IP Address / Netmask
Next-hop IP Address 1
Appliance IP / Netmask
Next-hop IP 2
LAN Next-hop IP (optional)

1
In the example, Site B’s appliance and mgmt0 are both on the same subnet, so their Next-hop IP addresses are the same. It is not a requirement that they be on the same subnet.

2
In the example, Site B’s appliance and mgmt0 are both on the same subnet, so their Next-hop IP addresses are the same. It is not a requirement that they be on the same subnet.


Please send comments or suggestions regarding user documentation to techpubs@silver-peak.com.